Pith. sign in

REVIEW 6 major objections 4 minor 3 cited by

Risk In Context: Benchmarking Privacy Leakage of Foundation Models in Synthetic Tabular Data Generation

T0 review · 6 major / 4 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Foundation models that generate tabular data by in-context learning are the most privacy-leaky generators, with LLaMA 3.3 70B up to 54 pp worse than the safest deep baseline.

desk verdict Plausible qualitative finding on ICL tabular leakage, but the headline numbers don't add up and the attack suite is unvalidated, so the quantitative claims are not yet trustworthy. read the letter →

arxiv 2507.17066 v1 pith:77ULOZN6 submitted 2025-07-22 cs.LG stat.ML

Jessup Byun , Xiaofeng Lin , Joshua Ward , Guang Cheng This is my paper
classification cs.LGstat.ML
keywords synthetictabulardatamembershipinferenceattacksin-contextlearningprivacyleakagefoundationmodelslow-dataregimeprivacy-utilitytrade-offpromptengineering
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper benchmarks three foundation-model generators (GPT-4o-mini, LLaMA 3.3 70B, TabPFN v2) against four data-specific baselines (CTGAN, TVAE, TabDiff, SMOTE) on 35 real-world tables in low-data regimes of 32, 64, and 128 training rows. It claims that foundation models using in-context learning consistently sit at the high end of the privacy-risk spectrum as measured by worst-case membership-inference AUC across 13 attacks. LLaMA 3.3 70B is the riskiest, reaching up to 54 percentage points higher true-positive rate at 1% false-positive rate than the safest deep baseline, while GPT-4o-mini and TabPFN hover near the upper bound of the deep-generator cluster. The paper also claims that three prompt-level tweaks — small batch size, low but nonzero temperature, and inclusion of summary statistics — cut worst-case AUC by up to 14 points and rare-class leakage by 24–39 points, while retaining over 90% of baseline fidelity. A sympathetic reader would care because these low-data regimes are precisely where synthetic data is most needed, and the paper maps the privacy cost of adopting the newest generation of generators.

What carries the argument

The central measuring device is the worst-case membership-inference leakage, defined as $\mathrm{Leakage} = \max_{A \in \mathcal{A}} \mathrm{AUC}(A)$, the maximum Area Under the ROC Curve taken over a suite $\mathcal{A}$ of 13 attacks spanning distance, density, and classifier signals, following the empirical-worst-case principle of Empirical Differential Privacy. This converts abstract privacy risk into one comparable number per generator–dataset split, enabling the privacy–utility frontier plots. The mechanism driving the prompt-level results is the concentration of generation mass on the data distribution's mode: smaller batch sizes reduce the chance rare combinations appear in the prompt, and lower temperature shrinks decoding entropy, both suppressing long-tail diversity, which is exactly the signal membership-inference attacks exploit.

What would settle it

Recompute the worst-case AUC on the same 35 tables, three seeds, and subset sizes using an independently implemented attack suite (for example, the original DOMIAS, GAN-Leaks, or TAPAS code) and compare with Table 2; if LLaMA 3.3 70B no longer exceeds CTGAN and TVAE by tens of percentage points, the central claim fails. Alternatively, directly count verbatim reproductions of seed rows in LLaMA 3.3 70B outputs; if they are negligible, the proposed leakage mechanism is wrong.

Watch

Extended reading notes

Core claim

In-context learning generators are measurably leakier than trained deep generators: across 35 tables and three subset sizes, the mean worst-case membership-inference AUC for foundation models falls in 0.587–0.667, versus 0.580–0.627 for CTGAN, TVAE, and TabDiff, and the operational TPR at 1% FPR rises from 0.042–0.061 to 0.054–0.181. The leakage is not uniform within the foundation family — LLaMA 3.3 70B is consistently the riskiest (mean AUC 0.667, TPR at 1% FPR 0.181) while GPT-4o-mini and TabPFN track the upper end of the deep cluster — and every learned generator leaks more at n=32 than at n=128. On the privacy–utility frontier, CTGAN and GPT-4o-mini fall below the naive diagonal, offering better trade-offs, whereas LLaMA and especially SMOTE (AUC 0.831) sit above it. The factorial study shows that the privacy gain from prompt tweaks comes almost entirely from suppressing rare-value emission: rare-class AUC drops from 0.979 to 0.740 with batch size 10 and to 0.842 with temperature 0.1, even though overall AUC changes by only 3–11 points.

Load-bearing premise

The leakage numbers assume the Synth-MIA library's 13 membership-inference attacks — including the DPI attack developed by the same group — are correctly implemented, but the paper provides no independent validation or code release; if those implementations are biased or buggy, the worst-case AUC values and the model ranking could change.

Editorial extensions

If this is right

  • Practitioners using LLMs for low-data tabular augmentation should treat the released synthetic set as higher-risk than CTGAN or TVAE output, especially for open-source 70B-class models.
  • Leakage is highest at the smallest sample sizes (n=32) and decreases monotonically as seeds grow, so mitigation efforts should prioritize the most extreme low-data regimes.
  • The prompt recipe of small batch, low nonzero temperature, and explicit summary statistics is an immediately deployable, retraining-free defense that costs at most about 10% of marginal-shape fidelity.
  • Privacy and utility lie on a roughly monotone frontier: higher fidelity, correlation similarity, or downstream AUC comes with higher worst-case membership leakage, and the best trade-offs are achieved by CTGAN and GPT-4o-mini rather than by the other foundation models.
  • The risk concentrates on rare rows, so protecting outliers directly conflicts with preserving their statistical signal; any defense that suppresses rare values will reduce rare-class utility.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the leakage ranking holds across independent implementations, worst-case membership-inference AUC could serve as a cheap, model-agnostic audit signal for released synthetic tables, letting regulators check privacy without access to generator weights.
  • The observed rare-row mechanism suggests a testable defense: deliberately perturb or drop long-tail values before release, and measure both the drop in rare-class AUC and the corresponding loss in rare-class downstream utility; the paper predicts these move together.
  • The prompt-recipe results were measured on LLaMA 3.3 70B only; running the same factorial study on GPT-4o-mini and TabPFN would reveal whether the diversity-collapse mechanism is specific to decoder-only LLMs or generalizes across foundation-model architectures.
  • Because the attack library and one of the key attacks (DPI) come from the same group and are marked as under review, an external re-implementation of the 13 attacks is needed before the absolute AUC numbers are used to rank models; the paper's own conclusions would survive only if the ranking is reproduced.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

6 major / 4 minor

Summary. The paper presents a benchmark of three foundation-model generators (GPT-4o-mini, LLaMA 3.3 70B, TabPFN v2) against four baselines (CTGAN, TVAE, TabDiff, SMOTE) on 35 real-world tabular datasets under low-data subsamples of 32, 64, and 128 rows. It evaluates statistical fidelity, downstream utility, and worst-case membership-inference leakage using 13 attacks, and reports that foundation models occupy the higher end of the privacy-risk spectrum, with LLaMA 3.3 70B the riskiest. A factorial study on LLaMA 3.3 70B prompts suggests that small batch size, low temperature, and inclusion of summary statistics reduce leakage at some fidelity cost. The central claim is that in-context-learning tabular generators leak more than trained deep generators in low-data regimes.

Significance. If the reported result holds, the benchmark would be a valuable practical guide for selecting synthetic-data generators in privacy-sensitive low-data settings, and the prompt-level mitigation recipe is immediately deployable without retraining. The study covers a wide range of models, 35 datasets, three subset sizes, and 13 membership-inference attacks, which is a substantial empirical effort. However, the significance is tempered by two factors: the measurement instrument is the authors' own unreleased Synth-MIA library (reference [52], under review), and several headline quantitative claims are not consistent with the reported tables. The paper's own limitation paragraph honestly acknowledges the focus on membership inference only, which is a positive sign of balance.

major comments (6)
  1. [Abstract / Section 4.1 / Table 2] The claim that LLaMA 3.3 70B yields "up to 54 percentage points higher TPR at 1% FPR" is not supported by the aggregate statistics reported in Table 2. The mean TPR@FPR=0.01 for LLaMA 3.3 70B is 0.181 and for CTGAN is 0.042, a difference of 13.9 percentage points, and no per-dataset results are provided to substantiate an "up to 54 pp" bound. Please either report the per-dataset or per-split distribution that yields the 54 pp figure or correct the claim in the abstract and contributions.
  2. [Section 4.4 / Table 3 / Abstract] The mitigation claims are inconsistent with Table 3. Reducing batch size from the default to k=10 lowers Max Attack AUC from 0.814 to 0.702, an 11.2 percentage point drop, not 14 pp as stated in the abstract and Section 4.4. Similarly, the abstract's "rare-class leakage by up to 39 pp" does not follow from the rare-class AUC values in Table 3: the default is 0.979 and the smallest value is 0.740, a difference of 23.9 pp. The Section 4.4 practical takeaway states "cuts worst-case AUC by up to 0.11", which contradicts the 14 pp claim. These numbers need to be reconciled.
  3. [Section 4.1 / Table 2] The statement that "foundation models consistently occupy the upper end of the privacy-risk spectrum" is not supported by the reported means. GPT-4o-mini's mean worst-case AUC (0.587) is below TabDiff (0.600) and TVAE (0.627), and its TPR@FPR=0.01 (0.054) is below TVAE (0.061). The ranges overlap (0.587-0.667 for foundation models versus 0.580-0.627 for CTGAN, TVAE, TabDiff), so the central ranking claim needs either per-dataset evidence of a consistent ordering or a more qualified formulation that identifies LLaMA 3.3 70B and TabPFN v2 as the elevated-risk models.
  4. [Section 3.3.3] The leakage ranking is computed exclusively with the Synth-MIA library (reference [52]), which is the authors' own manuscript under review and not publicly available, and includes the DPI attack (reference [38]) from the same group. No validation is reported against original attack implementations or an independent audit suite. Because the paper's main finding is a ranking based on worst-case AUC over these 13 attacks, a biased or incorrect attack implementation could change the ranking. The authors should release the code and data, or provide a validation study comparing Synth-MIA's outputs to the original implementations (e.g., GAN-Leaks, TAPAS) on a shared set of datasets.
  5. [Section 3.2 / reference [46]] The paper describes the OpenML-CTR23 suite as "35 classification tables", but reference [46] is titled "a curated tabular regression benchmarking suite". The manuscript does not state how regression targets were converted to classification, or whether the suite actually contains classification tasks. This ambiguity affects the validity of the stratified splitting procedure and the downstream utility evaluation (which uses macro-average ROC AUC). Please clarify the dataset construction and any target transformation.
  6. [Section 4.1 text] The statement that LLaMA 3.3 70B exceeds the safest data-specific generator "by roughly +0.09pp" is numerically wrong: the difference in mean worst-case AUC between LLaMA 3.3 70B (0.667) and CTGAN (0.580) is 0.087 AUC, which is 8.7 percentage points, not 0.09 percentage points. Please correct this quantitative misstatement.
minor comments (4)
  1. [Section 3.3.2] The paragraph on downstream utility ends with an incomplete sentence "For" before the section break; this appears to be a typographical error and should be completed or removed.
  2. [Section 4.1] The claim that an adversary can recover "up to three times as many true members" is ambiguous: comparing LLaMA 3.3 70B's TPR@FPR=0.01 (0.181) to TVAE (0.061) gives a factor of about 3.0, but comparing to CTGAN (0.042) gives a factor of 4.3. The sentence should specify the baseline used for the ratio.
  3. [Section 4.4 / Table 3] The row "Summary stats not in prompt" shows an increase in Max Attack AUC (0.878) but a decrease in Rare-Class AUC (0.904 versus 0.979 default). The text interprets this row only as "increases leakage", without noting that rare-class leakage is reduced; this partial contradiction should be explained.
  4. [Section 4.2] The claim that every learned generator shows a monotone decrease in leakage as n grows is stated without a table of per-size means; adding the n=32,64,128 values for each model would make this claim verifiable.

Circularity Check

1 steps flagged · score 4.0 of 10

Privacy-leakage ranking depends on the authors' own unreviewed Synth-MIA attack library and the same group's DPI attack; no formal equation-level circularity, but the central measurement instrument is a load-bearing self-citation.

  1. self citation load bearing [Section 3.3.3 (Leakage formula), Table 1, refs [38] and [52]]
    "Leakage=max_{A∈A} AUC(A). ... All attacks are re-implemented in a common Python framework; no model re-training is required. Table 1 lists the methods. We used the Synth-MIA [52] library as our attack framework implementation."

    The benchmark's central finding—that ICL foundation models occupy the upper end of the privacy-risk spectrum—is read directly from the Leakage metric, whose attack set A is implemented entirely by Synth-MIA (ref [52], 'Manuscript under review' by Ward, Lin, Wang, and Cheng) and includes the same group's DPI attack (ref [38]). The paper neither releases Synth-MIA nor checks it against an external audit suite, so the ranking has no independent evidential anchor outside the authors' own unverified implementation.

full rationale

No fitted parameter is renamed as a prediction, no uniqueness theorem is imported from prior same-author work, and the fidelity/utility axes use external datasets and public models. The only candidate circularity is the privacy instrument: Section 3.3.3 defines leakage as the max AUC over the attack set A and states that all attacks were run through Synth-MIA, a same-author manuscript under review, with DPI (also same-author) as one of the 13 attacks. Because the headline result is exactly the output of this unreviewed self-cited tool, the claim lacks an external validation anchor; that warrants a moderate score. However, this is not a definitional equivalence (the attack AUCs could in principle have come out differently), so a higher score would overstate the circularity. If the authors release Synth-MIA and validate the attacks against an independent suite, the concern would be resolved and the score would drop to 0-2.

Assumptions & free parameters 1 free parameters · 4 assumptions · 0 invented entities

The benchmark's conclusions depend on the correctness of the authors' unreviewed attack library, the validity of worst-case AUC as a leakage measure, and the assumed domain and task nature of the CTR23 suite. The paper provides no independent evidence for these premises.

free parameters (1)
  • rare-class frequency threshold = <=5%
    Defines 'rare' rows for the rare-class AUC result (Section 4.4). With n=32 splits, 5% can correspond to one or two rows, making the reported rare-class leakage reductions sensitive to this hand-chosen cut.
assumptions (4)
  • domain assumption The Synth-MIA library correctly implements all 13 membership-inference attacks.
    Section 3.3.3 states all attacks are re-implemented in Synth-MIA [52], an under-review manuscript by the same authors; no external validation is provided.
  • domain assumption Max-attack AUC is a valid worst-case privacy leakage metric.
    Section 3.3.3 adopts the EDP empirical worst-case principle; the resulting AUC and TPR values are treated as comparable across models and datasets.
  • domain assumption The 35 OpenML tables are classification tasks from health, finance, and policy domains.
    Section 3.2 and the abstract assert this, but reference [46] describes OpenML-CTR23 as a tabular regression suite; no per-dataset domain labels are given.
  • domain assumption The low-data subsamples and reference sets are drawn from the same population distribution.
    Shadow-box attacks require a reference set R from the same population; Section 3.2 draws training subsamples from an 80/20 split, but the reference set construction is not detailed.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Risk In Context: Benchmarking Privacy Leakage of Foundation Models in Synthetic Tabular Data Generation." pith.science (2026). https://pith.science/paper/77ULOZN6

@misc{pith2026250717066,
  author       = {Pith},
  title        = {Pith review of: Risk In Context: Benchmarking Privacy Leakage of Foundation Models in Synthetic Tabular Data Generation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/77ULOZN6}},
  note         = {Machine review of arXiv:2507.17066}
}
read the original abstract

Synthetic tabular data is essential for machine learning workflows, especially for expanding small or imbalanced datasets and enabling privacy-preserving data sharing. However, state-of-the-art generative models (GANs, VAEs, diffusion models) rely on large datasets with thousands of examples. In low-data settings, often the primary motivation for synthetic data, these models can overfit, leak sensitive records, and require frequent retraining. Recent work uses large pre-trained transformers to generate rows via in-context learning (ICL), which needs only a few seed examples and no parameter updates, avoiding retraining. But ICL repeats seed rows verbatim, introducing a new privacy risk that has only been studied in text. The severity of this risk in tabular synthesis-where a single row may identify a person-remains unclear. We address this gap with the first benchmark of three foundation models (GPT-4o-mini, LLaMA 3.3 70B, TabPFN v2) against four baselines on 35 real-world tables from health, finance, and policy. We evaluate statistical fidelity, downstream utility, and membership inference leakage. Results show foundation models consistently have the highest privacy risk. LLaMA 3.3 70B reaches up to 54 percentage points higher true-positive rate at 1% FPR than the safest baseline. GPT-4o-mini and TabPFN are also highly vulnerable. We plot the privacy-utility frontier and show that CTGAN and GPT-4o-mini offer better tradeoffs. A factorial study finds that three zero-cost prompt tweaks-small batch size, low temperature, and using summary statistics-can reduce worst-case AUC by 14 points and rare-class leakage by up to 39 points while maintaining over 90% fidelity. Our benchmark offers a practical guide for safer low-data synthesis with foundation models.

Figures

Figures reproduced from arXiv: 2507.17066 by the authors.

Figure 1
Figure 1. Privacy leakage (mean worst-case AUC) for each synthetic data generator across three subset sizes. For each model we [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗
Figure 2
Figure 2. Privacy–utility trade-off across synthetic generators. Each point represents one generator’s [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. Binned value–frequency distributions for the numeric column [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗

Discussion (0). Sign in to comment.

Forward citations

Cited by 3 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. Beyond IID: How General Are Tabular Foundation Models, Really?

    cs.LG 2026-06 unverdicted novelty 7.0 of 10

    Tabular foundation models excel on tiny- to medium-sized IID data but are outperformed by traditional tree-based and deep learning models on non-IID, large, and high-dimensional datasets, based on evaluations across 1...

  2. When Tables Leak: Attacking String Memorization in LLM-Based Tabular Data Generation

    cs.LG 2025-12 conditional novelty 7.0 of 10

    LLM tabular generators leak memorized numeric strings, allowing a no-box attack to achieve near-perfect membership inference on some state-of-the-art models.

  3. Privacy Vulnerabilities of Attention Layers in Tabular Foundation Models and Protection of High-Risk Queries

    cs.CR 2026-06 unverdicted novelty 5.0 of 10

    Attention layers in tabular foundation models enable effective membership inference attacks via pattern concentration, addressed by an inference-time k-anonymity defense on high-risk queries that cuts leakage by ~50% ...

Reference graph

Works this paper leans on

62 extracted references · 43 canonical work pages · cited by 3 Pith papers

  1. [52]

    Synth-MIA: A Testbed for Auditing Privacy Leakage in Tabular Data Synthesis

    Joshua Ward, Xiaofeng Lin, Chi-Hua Wang, and Guang Cheng. Synth-MIA: A Testbed for Auditing Privacy Leakage in Tabular Data Synthesis. Manuscript under review, Los Angeles, CA, USA, (2025)

    work page 2025

  2. [38]

    Zilong Zhao, Robert Birke, and Lydia Chen. 2023. Tabula: harnessing language models for tabular data synthesis.arXiv preprint arXiv:2310.12746

    arXiv 2023

  3. [46]

    Sebastian Felix Fischer, Liana Harutyunyan Matthias Feurer, and Bernd Bischl

    work page

  4. [1]

    Joao Fonseca and Fernando Bacao. 2023. Tabular and latent space synthetic data generation: a literature review.Journal of Big Data, 10, 1, 115

    work page 2023

  5. [2]

    Vibeke Binz Vallevik et al. 2024. Can i trust my fake data–a comprehensive qual- ity assessment framework for synthetic tabular data in healthcare.International Journal of Medical Informatics, 105413

    work page 2024

  6. [3]

    Mikel Hernandez, Gorka Epelde, Ane Alberdi, Rodrigo Cilla, and Debbie Rankin

    work page

  7. [4]

    Jinhong Wu, Konstantinos Plataniotis, Lucy Liu, Ehsan Amjadian, and Yuri Lawryshyn. 2023. Interpretation for variational autoencoder used to generate financial synthetic tabular data.Algorithms, 16, 2, 121

    work page 2023

  8. [5]

    Michael Platzer and Thomas Reutterer. 2021. Holdout-based empirical assess- ment of mixed-type synthetic data.Frontiers in big Data, 4, 679939

    work page 2021

Show all 62 references
  1. [6]

    Ryan McKenna, Brett Mullins, Daniel Sheldon, and Gerome Miklau. 2022. Aim: an adaptive and iterative mechanism for differentially private synthetic data. Proceedings of the VLDB Endowment, 15, 11, 2599–2612

    2022

  2. [7]

    Lei Xu, Maria Skoularidou, Alfredo Cuesta-Infante, and Kalyan Veeramacha- neni. 2019. Modeling tabular data using conditional gan.Advances in neural information processing systems, 32

    2019

  3. [8]

    Jayoung Kim, Jinsung Jeon, Jaehoon Lee, Jihyeon Hyeong, and Noseong Park

  4. [9]

    Zilong Zhao, Aditya Kunar, Robert Birke, Hiek Van der Scheer, and Lydia Y Chen. 2024. Ctab-gan+: enhancing tabular data synthesis.Frontiers in big Data, 6, 1296508

    2024

  5. [10]

    Akim Kotelnikov, Dmitry Baranchuk, Ivan Rubachev, and Artem Babenko

  6. [11]

    Hengrui Zhang, Jiani Zhang, Zhengyuan Shen, Balasubramaniam Srinivasan, Xiao Qin, Christos Faloutsos, Huzefa Rangwala, and George Karypis. 2024. Mixed-type tabular data synthesis with score-based diffusion in latent space. InThe Twelfth International Conference on Learning Rep...

    2024

  7. [12]

    Boris van Breugel, Hao Sun, Zhaozhi Qian, and Mihaela van der Schaar. 2023. Membership inference attacks against synthetic data through overfitting de- tection. (2023). arXiv: 2302.12580[cs.LG]

    2023 arXiv

  8. [13]

    Laird, Caesar Vazquez, Andy Lin, Amy Wagler, and Tony Chiang

    Reilly Cannon, Nicolette M. Laird, Caesar Vazquez, Andy Lin, Amy Wagler, and Tony Chiang. 2025. Assessing generative models for structured data.arXiv preprint arXiv:2503.20903. https://arxiv.org/abs/2503.20903

    2025 arXiv

  9. [14]

    Zhuoyan Li, Hangxiao Zhu, Zhuoran Lu, and Ming Yin. 2023. Synthetic data generation with large language models for text classification: potential and limitations.arXiv preprint arXiv:2310.07849

    2023 arXiv

  10. [15]

    Nabeel Seedat, Nicolas Huynh, Boris van Breugel, and Mihaela van der Schaar

  11. [16]

    Noah Hollmann, Samuel Müller, Katharina Eggensperger, and Frank Hutter

  12. [17]

    Noah Hollmann, Samuel Müller, Lennart Purucker, Arjun Krishnakumar, Max Körfer, Shi Bin Hoo, Robin Tibor Schirrmeister, and Frank Hutter. 2025. Accu- rate predictions on small data with a tabular foundation model.Nature, 637, 8045, 319–326

    2025

  13. [18]

    Rui Wen, Zheng Li, Michael Backes, and Yang Zhang. 2024. Membership infer- ence attacks against in-context learning. InProceedings of the ACM Conference on Computer and Communications Security (CCS). ACM, 1–15

    2024

  14. [19]

    Krishna Kanth Nakka, Ahmed Frikha, Ricardo Mendes, Xue Jiang, and Xuebing Zhou. 2025. PII-scope: a comprehensive study on training data PII extraction attacks in large language models.arXiv preprint arXiv:2410.06704

    2025 arXiv

  15. [20]

    Inan, Andre Manoel, Fatemehsadat Mireshghallah, Zinan Lin, Sivakanth Gopi, Janardhan Kulkarni, and Robert Sim

    Xinyu Tang, Richard Shin, Huseyin A. Inan, Andre Manoel, Fatemehsadat Mireshghallah, Zinan Lin, Sivakanth Gopi, Janardhan Kulkarni, and Robert Sim. 2024. Privacy-preserving in-context learning with differentially private few-shot generation. InInternational Conference on Learn...

    2024

  16. [21]

    Tabpfn: a transformer that solves small tabular classification problems in a second.arXiv preprint arXiv:2207.01848

    arXiv

  17. [22]

    Nitesh V Chawla, Kevin W Bowyer, Lawrence O Hall, and W Philip Kegelmeyer

  18. [23]

    Beata Nowok, Gillian M Raab, and Chris Dibben. 2016. Synthpop: bespoke creation of synthetic data in r.Journal of statistical software, 74, 1–26

    2016

  19. [24]

    Zhengping Che, Yu Cheng, Shuangfei Zhai, Zhaonan Sun, and Yan Liu. 2017. Boosting deep learning risk prediction with generative adversarial networks for electronic health records. In2017 IEEE International Conference on Data Mining (ICDM). IEEE, 787–792

    2017

  20. [25]

    Alvaro Figueira and Bruno Vaz. 2022. Survey on synthetic data generation, evaluation methods and gans.Mathematics, 10, 15, 2733

    2022

  21. [26]

    Jerome P Reiter. 2005. Using cart to generate partially synthetic public use microdata.Journal of official statistics, 21, 3, 441

    2005

  22. [27]

    Namjoon Suh, Xiaofeng Lin, Din-Yin Hsieh, Merhdad Honarkhah, and Guang Cheng. 2023. Autodiff: combining auto-encoder and diffusion model for tabular data synthesizing.CoRR, abs/2310.15479. https://doi.org/10.48550/arXiv.2310.1 5479

    2023 doi arXiv

  23. [28]

    James Jordon, Jinsung Yoon, and Mihaela Van Der Schaar. 2018. Pate-gan: generating synthetic data with differential privacy guarantees. InInternational conference on learning representations

    2018

  24. [29]

    Jun Zhang, Graham Cormode, Cecilia M Procopiuc, Divesh Srivastava, and Xiaokui Xiao. 2017. Privbayes: private data release via bayesian networks.ACM Transactions on Database Systems (TODS), 42, 4, 1–41

    2017

  25. [30]

    Dionysis Manousakas and Sergül Aydöre. 2023. On the usefulness of synthetic tabular data generation.arXiv preprint arXiv:2306.15636

    2023 arXiv

  26. [31]

    Vadim Borisov, Kathrin Sessler, Tobias Leemann, Martin Pawelczyk, and Gjergji Kasneci. 2023. Language models are realistic tabular data generators. InThe Eleventh International Conference on Learning Representations. https://openrevi ew.net/forum?id=cEygmQNOeI

    2023

  27. [32]

    Zilong Zhao, Aditya Kunar, Robert Birke, and Lydia Y Chen. 2021. Ctab-gan: effective table data synthesizing. InAsian Conference on Machine Learning. PMLR, 97–112

    2021

  28. [33]

    Jinhee Kim, Taesung Kim, and Jaegul Choo. 2025. Epic: effective prompting for imbalanced-class data synthesis in tabular data classification via large lan- guage models. InAdvances in Neural Information Processing Systems (NeurIPS). arXiv:2404.12404

    2025 arXiv

  29. [34]

    Junwei Ma, Apoorv Dankar, George Stein, Guangwei Yu, and Anthony Caterini

  30. [35]

    Jamie Hayes, Luca Melis, George Danezis, and Emiliano De Cristofaro. 2017. Logan: membership inference attacks against generative models.Proceedings on Privacy Enhancing Technologies, 2019, 133–152. https://api.semanticscholar .org/CorpusID:52211986

    2017

  31. [36]

    Benjamin Hilprecht, Martin Härterich, and Daniel Bernau. 2019. Monte carlo and reconstruction membership inference attacks against generative models. Proceedings on Privacy Enhancing Technologies, 2019, 232–249. https://api.sema nticscholar.org/CorpusID:199546273

    2019

  32. [37]

    Dingfan Chen, Ning Yu, Yang Zhang, and Mario Fritz. 2020. Gan-leaks: a taxon- omy of membership inference attacks against generative models. InProceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security (CCS ’20). ACM, (Oct. 2020). doi:10.1145/3372297.3417238

    2020

  33. [39]

    Alexandre Sablayrolles, Matthijs Douze, Cordelia Schmid, Yann Ollivier, and Hervé Jégou. 2019. White-box vs black-box: bayes optimal strategies for mem- bership inference. InInternational Conference on Machine Learning. PMLR, 5558–5567

    2019

  34. [40]

    Theresa Stadler, Bristena Oprisanu, and Carmela Troncoso. 2022. Synthetic data – anonymisation groundhog day. In31st USENIX Security Symposium (USENIX Security 22). USENIX Association, Boston, MA, (Aug. 2022), 1451– 1468.isbn: 978-1-939133-31-1. https://www.usenix.org/conferen...

    2022

  35. [41]

    Tabpfgen – tabular data generation with tabpfn.arXiv preprint arXiv:2406.05216

    arXiv

  36. [42]

    Lecture Notes in Computer Science

    2024.Achilles’ heels: vulnerable record identification in synthetic data publishing. Lecture Notes in Computer Science. Springer Nature Switzerland, 380–399.isbn: 9783031514760. doi:10.1007/978-3-031-51476-0_19

    2024 doi

  37. [43]

    OpenAI. 2024. GPT-4o Mini model in chat completions api. https://platfor m.openai.com/docs/models/gpt- 4o- mini. Released July 18, 2024; accessed 2025-06-13. (2024)

    2024

  38. [44]

    Meta AI. 2024. LLaMA-3.3 70B instruct model. https://huggingface.co/meta-lla ma/Llama-3.3-70B-Instruct. Released December 6, 2024; accessed 2025-06-13. (2024)

    2024

  39. [45]

    Joshua Ward, Chi-Hua Wang, and Guang Cheng. 2024. Data plagiarism index: characterizing the privacy risk of data-copying in tabular generative models. KDD- Generative AI Evaluation Workshop. https://arxiv.org/abs/2406.13012 arXiv: 2406.13012[cs.LG]

    2024 arXiv

  40. [47]

    2023.Synthetic Data Metrics

    DataCebo, Inc. 2023.Synthetic Data Metrics. Version 0.12.0. DataCebo, Inc. (Oct. 2023). https://docs.sdv.dev/sdmetrics/

    2023

  41. [48]

    Florimond Houssiau, James Jordon, Samuel N Cohen, Owen Daniel, Andrew Elliott, James Geddes, Callum Mole, Camila Rangel-Smith, and Lukasz Szpruch

  42. [49]

    Tapas: a toolbox for adversarial privacy auditing of synthetic data.arXiv preprint arXiv:2211.06550

    arXiv

  43. [50]

    Steven Golob, Sikha Pentyala, Anuar Maratkhan, and Martine De Cock. 2024. Privacy vulnerabilities in marginals-based synthetic data. (2024). https://arxiv .org/abs/2410.05506 arXiv: 2410.05506[cs.CR]

    2024 arXiv

  44. [51]

    Matthew Jagielski, Jonathan Ullman, and Alina Oprea. 2020. Auditing differ- entially private machine learning: how private is private sgd? InProceedings of the 34th International Conference on Neural Information Processing Systems (NIPS ’20) Article 1862. Curran Associates Inc...

    2020

  45. [53]

    Juntong Shi, Minkai Xu, Harper Hua, Hengrui Zhang, Stefano Ermon, and Jure Leskovec. [n. d.] Tabdiff: a unified diffusion model for multi-modal tabular data generation. InNeurIPS 2024 Third Table Representation Learning Workshop

    2024

  46. [55]

    In AutoML Conference 2023 (Workshop)

    OpenML-CTR23 – a curated tabular regression benchmarking suite. In AutoML Conference 2023 (Workshop). https://openreview.net/forum?id=Heb AOoMm94

    2023

  47. [57]

    Tianqi Chen and Carlos Guestrin. 2016. Xgboost: a scalable tree boosting system. InProceedings of the 22nd acm sigkdd international conference on knowledge discovery and data mining, 785–794. Risk In Context: Benchmarking Privacy Leakage of Foundation Models in Synthetic Tabul...

    2016

  48. [58]

    Liudmila Prokhorenkova, Gleb Gusev, Aleksandr Vorobev, Anna Veronika Dorogush, and Andrey Gulin. 2018. Catboost: unbiased boosting with categori- cal features.Advances in neural information processing systems, 31

    2018

  49. [62]

    synthetic_data

    Ahmed Alaa, Boris Van Breugel, Evgeny S Saveliev, and Mihaela van der Schaar. 2022. How faithful is your synthetic data? sample-level metrics for evaluating and auditing generative models. InInternational Conference on Machine Learning. PMLR, 290–306. Jessup Byun, Xiaofeng Lin...

    2022

  50. [2002]

    Smote: synthetic minority over-sampling technique.Journal of artificial intelligence research, 16, 321–357

  51. [2021]

    InProceedings of the Web Conference 2021, 1506–1515

    Oct-gan: neural ode-based conditional tabular gans. InProceedings of the Web Conference 2021, 1506–1515

    2021

  52. [2022]

    Neurocomputing, 493, 28–45

    Synthetic data generation for tabular health records: a systematic review. Neurocomputing, 493, 28–45

  53. [2023]

    InInternational Conference on Machine Learning

    Tabddpm: modelling tabular data with diffusion models. InInternational Conference on Machine Learning. PMLR, 17564–17579

  54. [2024]

    InForty-first International Conference on Machine Learning

    Curated llm: synergy of llms and data curation for tabular augmentation in low-data regimes. InForty-first International Conference on Machine Learning

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.